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DETAILED ACTION 

This is a final action for application number 10/522,919 after a non-final filed on 
12/29/2008. The original application was filed on 01/31/2005. Claim 1, 12, 20, 23, 30, 
31 , 32, and 36 are amended. Claims 1 - 36 are currently pending and have been 
considered below. Claims 1,12, 20, 23, 31, 32, and 36 are independent claims. 

AoDlicant's Response 

Applicant's arguments with respect to claims 1 - 36 have been considered but are 
moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC $ 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made to 
a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the Invention was made. 

Claims 1 - 4. 8 - 1 0, 1 2 - 1 5. 22 - 24. 31 - 34 and 36 are rejected under 35 
U.S.C. 1 03(a) as being unpatentable over Paul et al. (US 6.052.709). in view of Steiaer 
et al. (US 7.484.097) 



Regarding claims 1,12. 22. 23, and 36 . Paul et al. an apparatus comprising: at 
least one server configured to send outgoing electronic messages on behalf of terminals 
connected thereto and to deliver incoming electronic messages to the terminals, each 
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terminal being accessed by one or more users, [A plurality of network servers 120, 
121, and 122 are coupled to the control center 101 and the communications 
network 110 as shown in Fig. 1, wherein the servers are mail servers, (Paul et al.. 
Col. 3, lines 57 - 62)], 

tlie server comprising: means arranged to generate or receive traffic log data 
based on at least one traffic characteristic using data derived from the handling of plural 
electronic messages, [The user terminal may also perform filtering based upon 
filtering instructions received from the control center 101, wherein the received 
instructions are the log data used to handle the electronic message, (Paul et al.. 
Col. 6, lines 14-16)], 

analyzing means arranged to analyze the traffic log data as a function of a 
predetermined traffic characteristic criterion corresponding to malicious electronic 
message traffic to identify electronic messages that satisfy the traffic characteristic 
criterion, [Upon receipt of incoming mail addressed to the spam probe addresses, 
the spam control center automatically analyzes the received mail to identify the 
source of the message, extracts and processes the source data from the received 
message, wherein the received message is analyzed based on the characteristics 
that meet the criterion of a spam message, (Paul et al., Col. 2, lines 1 - 5)], 

identifying means arranged to identify the destination of the identified electronic 
messages, [users and/or service providers may optionally implement filtering 
based upon additional exclusion list categories, such as the "TO", "BCC," "CC," 
and "SUBJECT" e-mail headers and other headers. Filtering may also be based 
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on the contents in the body of the email, wherein the "to" identifies the 
destination, (Paul et al.. Col. 6, lines 7 - 12)], 

and processing means arranged to send a control message to each of the 
identified destinations, [generating an alert signal incorporating the extracted 
source data, (Paul et al., Col. 10, lines 4 - 6)], 

requesting suspension of delivery of the identified electronic messages, 
[messages marked with the first display code indicating the "JUNK" status of the 
message are not displayed in the user's in-box and are automatically discarded 
by the filter, wherein the alert message discards the electronic message, (Paul et 
al.. Col. 6, lines 65 - 67)], 

Paul et al. fails to explicitly teach traffic log data, 

Steiger et al. teaches that a security device, client device or client security 
device" may take the form of any suitable device that generates security log data, such 
as for example a firewall or IDS, (Steiger et al.. Col. 3, lines 47 - 52), in order to 
adequately protect computer information assets on a full-time basis, (Steiger et al.. Col. 
1, lines 47-50), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify Paul et al. by including log data as taught by Steiger et 
al., (Steiger et al.. Col. 3, lines 47 - 52), in order to adequately protect computer 
information assets on a full-time basis, (Steiger et al.. Col. 1, lines 47 - 50). 
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Regarding claims 2 and 13 . an apparatus wherein said server includes: first 
means arranged to receive a signal identifying whether or not an identified electronic 
message is related to an electronic message virus, [and generates an alert signal 
containing the spam source data, (Paul et al., Abstract)], 

and second means arranged to receive data indicative of the success or 
otherwise of the control message and, in the event that the received signal identifies an 
electronic message to be a virus and the control message is successful, to trigger 
deletion of the said identified electronic message, [The filtering system controls 
delivery of the unsolicited e-mail messages by discarding the messages without 
displaying them to the user, (Paul et al.. Col. 2, lines 17 - 20)]. 

Regarding claims 3 and 14 . an apparatus wherein: in the event that a received 
signal identifies an electronic message to be a virus and the control message is 
unsuccessful, the second means is arranged to trigger operation of identifying means 
and processing means running on a second server corresponding to the destination of 
the identified electronic message, [A plurality of network servers 120, 121, and 122 
are coupled to the control center 101 and the communications network 110. User 
terminals 130-138 are respectively coupled to servers 120-122 as shown in FIG. 1, 
(Paul et al., Col. 3, lines 59 - 63)]. 



Regarding claim 4 and 15 . an apparatus server wherein: in the event that a 
received signal identifies an electronic message not to be a virus and the control 
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message is successful, the second means is arranged to permit delivery of the identified 
electronic message, [A method for controlling delivery of unsolicited electronic 
mail, (Paul et al., Col. 2, lines 62 - 65)]. 

Regarding claim 8 . an apparatus for delivering electronic messages, comprising 
a plurality of apparatus wherein at least one of the therein servers comprises: receiving 
means arranged to receive a request to suspend delivery of an identified electronic 
message, [messages marked with the first display code indicating the "JUNK" 
status of the message are not displayed in the user's in-box and are automatically 
discarded by the filter, wherein the alert message discards the electronic 
message, (Paul et al.. Col. 6, lines 65 - 67)], 

and wherein, in response to receipt of a said request, polling means is arranged 
to check delivery of the identified electronic message, and in the event that it has not 
been delivered, to block retrieval thereof, [A method for controlling delivery of 
unsolicited electronic mail, (Paul et al.. Col. 2, lines 62 - 65)]. 

Regarding claim 9 , an apparatus wherein: the at least one server includes 
deleting means for deleting an electronic message, [The filtering system controls 
delivery of the unsolicited e-mail messages by discarding the messages without 
displaying them to the user, (Paul et al.. Col. 2, lines 17 - 20)], 

and in response to receipt of a signal identifying that an identified electronic 
message is related to an electronic message virus, the deleting means is arranged to 
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check whether retrieval of the identified electronic message has been blocked, and if it 
has, to delete it, [The filtering system controls delivery of the unsolicited e-mail 
messages by discarding the messages without displaying them to the user, (Paul 
et al., Col. 2, lines 17-20)]. 

Regarding claim 10 . an apparatus wherein: in the event that the identified 
electronic message is related to an electronic message virus, and the identified 
electronic message has not been blocked, the server is arranged to invoke its 
identifying means and processing means in respect of electronic messages sent by the 
identified destinations, [the spam control center automatically analyzes the 
received mail to identify the source of the message, extracts and processes the 
source data from the received message, (Paul et al.. Col. 2, lines 2 - 6)]. 

Regarding claim 24 . a server according to claim 23, the server comprising: 
identifying means arranged to identify the destination of said identified electronic 
messages, [users and/or service providers may optionally implement filtering 
based upon additional exclusion list categories, such as the "TO", "BCC," "CO," 
and "SUBJECT" e-mail headers and other headers. Filtering may also be based 
on the contents in the body of the email, wherein the "to" identifies the 
destination, (Paul et al.. Col. 6, lines 7 - 12)], 

and processing means arranged to send a control message to each of the 
identified destinations requesting suspension of delivery of the identified electronic 
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messages, [messages marked with the first display code indicating the "JUNK" 
status of the message are not displayed in the user's in-box and are automatically 
discarded by the filter, wherein the alert message discards the electronic 
message, (Paul et al.. Col. 6, lines 65 - 67)]. 

Regarding claims 31 and 32 . a tangible computer-readable storage medium 
having a computer program thereon for sending and receiving electronic messages, the 
program being executable on a terminal having a user interface, [A user interface 208 
is provided to receive Inputs from the user and to display e-mail information to 
the user, (Paul et al.. Col. 6, lines 32 - 35)], 

the computer program being configured to perform the following steps when 
executed: (a) invite a user to input at the user interface send instructions for sending 
one or more electronic messages, [A plurality of network servers 120, 121, and 122 
are coupled to the control center 101 and the communications network 110 as 
shown in Fig. 1, wherein the servers are mail servers, (Paul et al.. Col. 3, lines 57 - 
62)], 

(b) determine if traffic log data based on handling a plurality of electronic 
messages meets a predetermined traffic characteristic criterion corresponding to 
malicious electronic message traffic, [Upon receipt of incoming mail addressed to 
the spam probe addresses, the spam control center automatically analyzes the 
received mail to identify the source of the message, extracts and processes the 
source data from the received message, wherein the received message is 
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analyzed based on the characteristics that meet the criterion of a spam message, 
(Paul et al., Col. 2, lines 1 - 5)], 

(c) if the criterion is met, invite the user to input at the user interface a 
confirmation input to confirm the send instructions, [upon receipt of an electronic mail 
message addressed to the probe address, (Paul et al., Col. 2, lines 57 - 60)], 

(d) upon receipt of the confirmation input, transmit the electronic messages from 
the terminal, [generating an alert signal incorporating the processed source data, 
(Paul et al.. Col. 2, lines 60 - 62)], 

and (e) transmit authentication data associable with the transmitted electronic 
messages, [The network users may or may not be given authorization to access or 
change the exclusion list data entered by the system operator, (Paul et al.. Col. 9, 
lines 52 - 55)]. 

Regarding claim 33 . Paul et al. teaches a plurality of network servers 120, 121 , 
and 122 are coupled to the control center 101 and the communications network 1 10 as 
shown in Fig. 1, (Paul et al.. Col. 3, lines 57 - 62), 

Paul et al. fails to teach that the terminal is configured to transmit the 
authenticating data in encrypted form, 

Steiger et al. teaches that encryption may provide data confidentiality, while still 
allowing flexibility in the client and server application, (Steiger et al.. Col. 10, lines 63 - 
67), in order to adequately protect computer information assets on a full-time basis, 
(Steiger et al.. Col. 1, lines 47 - 50), 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify Paul et al. transmitting the authenticating data in 
encrypted form, (Steiger et al., Col. 10, lines 63 - 67), in order to adequately protect 
computer information assets on a full-time basis, (Steiger et al.. Col. 1, lines 47 - 50). 

Regarding claims 34 . a storage medium according to claim 31 , wherein: the 
computer program thereon is configured, when executed, to request a user to input 
password data as part of the confirmation instructions, and to only permit the terminal to 
send authentication data once the password data has been input by the user, [The 
network users may or may not be given authorization to access or change the 
exclusion list data entered by the system operator, (Paul et al.. Col. 9, lines 52 - 
55)]. 

Claims 5-7 and 1 6-1 8 are reiected under 35 U.S.C. 1 03(a) as being 
unpatentable over Paul et al. (US 6.052.709). in view of Steiger et al. (US 7.484.097) 
and further in view of Tovoshima et al. (6.298.349). 

Regarding claims 5, 7. 16 and 18 . The modified Paul et al. teaches an apparatus 
according to claim 1, wherein said server includes including: first storage for storing 
details data relating to such electronic messages, [The server 120 includes an e-mail 
server message store 506 for receiving and storing all e-mail messages 



Application/Control Number: 1 0/522,91 9 Page 1 1 

Art Unit: 2446 

transmitted within the network 110 and an e-mail filter 504, (Paul et al., Col. 8, 
Lines 20-25)], 

The modified Paul et al. fails to teach mapping between users and organizational 
units which users belong to. 

further storage for storing a mapping between users and organizational units to 
which the users belong, the system management program 220 stores names and 
identifiers (employee numbers) of employees user who belong to this subordinate 
organization into the personnel-organization database 26, (Toyoshima et al.. Col. 7, 
Lines 58-62)], display means for displaying a plurality of Images, each representative of 
an organizational unit, [FIG. 4 is a drawing illustrating an image displayed on the 
display device 200 in accordance with the group display function of the system 
management program 220, (Toyoshima et al.. Col. 8, lines 6-10), wherein the server 
Is arranged, In use, such that In response to a request for data relating to a user, the 
first storage Is arranged to output data identilying electronic messages emanating from 
that user, [The server 120 includes an e-mail server message store 506 for 
receiving and storing all e-mail messages transmitted within the network 110 and 
an e-mail filter 504, (Paul et al., Col. 8, Lines 20-25)], the further storage Is arranged 
to output data Identifying which of the organizational units that user belongs to, [the GUI 
module 222 outputs data, which is entered by a system administrator via the 
keyboard 204 or the like, to the database access module 224 and a given one of 
the GUIs 228, (Toyoshima et al.. Col. 7, lines 6-11)], and, for those electronic 
messages that are identified to satisfy the criterion, the display means is arranged to 
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insert, on the image corresponding to the identified organizational unit, a visual identifier 
representative of the volume or type of identified electronic messages, [in accordance 
with the networit system 1 of this invention, it is possible to visually display 
subordinate organizations of users in association with constituents of the 
network system 1, (Toyoshlma et al., Col. 12, lines 60-65)], to provide a system 
resource display apparatus and a method for use in a network system, comprising a 
plurality of devices such as computers or the like connected via a network, which are 
arranged to display information relating to hardware and/or software resources of each 
of the devices in association with users and organizational groups that possess the 
devices, (Toyoshlma et al.. Col. 1, lines 35-40), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by mapping between users and 
organizational units which users belong and displaying a plurality of images, each 
representative of an organizational unit, (Toyoshlma et al.. Col. 7, Lines 58-62), to 
provide a system resource display apparatus and a method for use in a network system, 
comprising a plurality of devices such as computers or the like connected via a network, 
which are arranged to display information relating to hardware and/or software 
resources of each of the devices in association with users and organizational groups 
that possess the devices, (Toyoshlma et al.. Col. 1, lines 35-40). 



Regarding claims 6 and 17 . an apparatus according to claim 5, wherein: for those 
electronic messages that are identified to satisfy the criterion, the display means is 
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arranged to display a list of users on an associated image, [identifying the messages 
as unsolicited messages by displaying the messages in a distinctive display 
mode, (Paul et al., Col. 1, lines 45 - 50)], 

and for each user on the list, to display details of the volume and/or type of 
identified electronic messages emanating therefrom, [Optionally, the filter 204 may 
use multiple display codes indicating multiple status levels of "JUNK.", (Paul et 
al.. Col. 6, lines 50 - 53)]. 

Claims 11, 19, and 35 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Paul et al. (US 6.052.709). in view of Steiqer et al. (US 7.484,097) 
and further in view of Tarbotton et al. (6.757.830). 

Regarding claims 11 and 19 , the modified Paul et al. teaches the server 120 
includes an e-mail server message store 506 for receiving and storing all e-mail 
messages transmitted within the network 1 10 and an e-mail filter 504, (Paul et al.. Col. 
8, Lines 20-25), 

The modified Paul et al. fails to teach that the criterion includes at least one of 
size of electronic message, 

Tarbotton et al. teaches the common characteristics that can be used to identify 
spam e-mails include a common sender, a common recipient, a common message title, 
a common message size, (Tarbotton et al.. Col. 7, lines 55-60), 
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the criteria includes an electronic message type or number of electronic 
messages emanating from a user, [Characteristics that may be used to determine 
the minimum delay period applied include sender characteristics, recipient 
characteristics, attachment type characteristics and message content type 
characteristics, (Tarbotton et al., Abstract), 

and (c) number of electronic messages emanating from a user, [FIG. 5 
illustrates characteristics of a number of example received e-mail messages and 
how the rules of FIG. 4 may produce a minimum delay period for each message, 
(Tarbotton et al., Col. 8, lines 15-18), to detect the unwanted properties as soon as an 
e-mail message is received or whilst it is being stored for the minimum delay period, 
and then these tests repeated only if they have been updated once the minimum delay 
period has expired, (Tarbotton et al.. Col. 3, lines 60-65), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by including an electronic message 
type, characteristics that may be used to determine the minimum delay period applied 
include sender characteristics, recipient characteristics, attachment type characteristics 
and message content type characteristics, (Tarbotton et a!., Abstract), 

and (c) number of electronic messages emanating from a user, (Tarbotton et a!.. 
Col. 8, lines 15-18), to detect the unwanted properties as soon as an e-mail message is 
received or whilst it is being stored for the minimum delay period, and then these tests 
repeated only if they have been updated once the minimum delay period has expired, 
(Tarbotton et al.. Col. 3, lines 60-65). 
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Regarding claims 35 , Paul et al. teaches one server configured to send outgoing 
electronic messages on behalf of terminals connected thereto and to deliver incoming 
electronic messages to the terminals, each terminal being accessed by one or more 
users, an incoming e-mail message is initially received at a remote e-mail server over a 
network, the incoming e-mail message is transmitted from the remote e-mail sever to 
the user computer over the network, if it is not blocked, (Paul et al., Col. 3, lines 57 - 
62), 

Paul et al. fails to teach a threshold data volume originates from a common 
terminal or user as a criteria, 

Tarbotton et al. teaches the criterion is met if traffic tog data corresponding to a 
target electronic message indicates that a threshold number of electronic messages 
and/or a threshold data volume originates from a common terminal or user, in a time 
interval during which the target electronic message was sent, [FIG. 5 Illustrates 
characteristics of a number of example received e-mail messages and how the 
rules of FIG. 4 may produce a minimum delay period for each message, 
(Tarbotton et a!., Col. 8, lines 15-18), to detect the unwanted properties as soon as an 
e-mail message is received or whilst it is being stored for the minimum delay period, 
and then these tests repeated only if they have been updated once the minimum delay 
period has expired, (Tarbotton et al.. Col. 3, lines 60-65), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by including an electronic message 
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type, characteristics that may be used to determine the minimum delay period applied 
include sender characteristics, recipient characteristics, attachment type characteristics 
and message content type characteristics, (Tarbotton et al., Abstract), and (c) number 
of electronic messages emanating from a user, (Tarbotton et al., Col. 8, lines 15-18), 
to detect the unwanted properties as soon as an e-mail message is received or whilst it 
is being stored for the minimum delay period, and then these tests repeated only if they 
have been updated once the minimum delay period has expired, (Tarbotton et al.. Col. 
3, lines 60-65). 

Claim 20 is rejected under 35 U.S.C. 103(a) as being unpatentable over Paul et 
al. (US 6.052.709). in view of Steiqer et al. (US 7.484.097) and further in view of Nielson 
et al. (US 6.453.327). 

Regarding claim 20 . Paul et al. teaches an apparatus according to claim 1 , 
wherein said server includes including: first storage for storing details data relating to 
such electronic messages, [The server 120 includes an e-mail server message store 
506 for receiving and storing all e-mail messages transmitted within the network 
110 and an e-mail filter 504, (Paul et al.. Col. 8, Lines 20-25)], 

Paul et al. fails to teach mapping between users and organizational units which 
users belong to. 

further storage for storing a mapping between users and organizational units to 
which the users belong, the system management program 220 stores names and 
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identifiers (employee numbers) of employees user who belong to this subordinate 
organization into the personnel-organization database 26, (Toyoshima et al., Col. 7, 
Lines 58-62)], 

display means for displaying a plurality of images, each representative of an 
organizational unit, [FIG. 4 Is a drawing illustrating an image displayed on the 
display device 200 in accordance with the group display function of the system 
management program 220, (Toyoshima et al.. Col. 8, lines 6-10), 

wherein the server is arranged, in use, such that in response to a request for 
data relating to a user, the first storage is arranged to output data identifying electronic 
messages emanating from that user, [The server 120 includes an e-mail server 
message store 506 for receiving and storing all e-mail messages transmitted 
within the network 110 and an e-mail filter 504, (Paul et al.. Col. 8, Lines 20-25)], 

the further storage is arranged to output data identifying which of the 
organizational units that user belongs to, [the GUI module 222 outputs data, which is 
entered by a system administrator via the keyboard 204 or the like, to the 
database access module 224 and a given one of the GUIs 228, (Toyoshima et al.. 
Col. 7, lines 6-11)], 

and, for those electronic messages that are identified to satisfy the criterion, the 
display means is arranged to insert, on the image corresponding to the identified 
organizational unit, a visual identifier representative of the volume or type of identified 
electronic messages, [in accordance with the network system 1 of this invention, it 
is possible to visually display subordinate organizations of users in association 
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with constituents of the network system 1, (Toyoshima et al., Col. 12, lines GO- 
GS)], to provide a system resource display apparatus and a method for use in a network 
system, comprising a plurality of devices such as computers or the like connected via a 
network, which are arranged to display information relating to hardware and/or software 
resources of each of the devices in association with users and organizational groups 
that possess the devices, (Toyoshima et al.. Col. 1, lines 35-40), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify Paul by mapping between users and organizational units 
which users belong and displaying a plurality of images, each representative of an 
organizational unit, (Toyoshima et al.. Col. 7, Lines 58-62), to provide a system 
resource display apparatus and a method for use in a network system, comprising a 
plurality of devices such as computers or the like connected via a network, which are 
arranged to display information relating to hardware and/or software resources of each 
of the devices in association with users and organizational groups that possess the 
devices, (Toyoshima et al.. Col. 1, lines 35-40), 

The modified Paul fails to teach analyzing means arranged to analyze the traffic 
log data as a function of a predetermined traffic characteristic criterion corresponding to 
malicious electronic message traffic to identify electronic messages that satisfy the 
traffic characteristic criterion, 

Nielsen et al. teaches each record 600 in the User's Junk E-mail database 
contains a "Junk E-mail Characteristics" field 601 and a "Last Date" field 603. The 
contents of the " Junk E-mail Characteristics " field 601 is associated with a set of text 
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strings, (Nielson et al., Col. 9, lines 13 - 20), in order to provide a meclianisnn for 
identifying and automatically deleting most junk e-mail messages, (Nielson et al., Col. 
3, lines 53 - 55), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by analyzing means arranged to 
analyze the traffic log data as a function of a predetermined traffic characteristic 
criterion corresponding to malicious electronic message traffic to identify electronic 
messages that satisfy the traffic characteristic criterion wherein Nielsen et al. teaches 
each record 600 in the User's Junk E-mail database contains a "Junk E-mail 
Characteristics" field 601 and a "Last Date" field 603. The contents of the " Junk E-mail 
Characteristics " field 601 is associated with a set of text strings, (Nielson et al.. Col. 9, 
lines 13 - 20), in order to provide a mechanism for identifying and automatically 
deleting most junk e-mail messages, (Nielson et al.. Col. 3, lines 53 - 55). 

Claim 21 is rejected under 35 U.S.C. 103(a) as being unpatentable over Paul et 
al. (US 6.052.709). in view of Steiaer et al. (US 7.484.097) and further in view of 
Tarbotton et al. (6.757.830) 

Regarding claim 21 . the modified Paul et al. teaches the server 120 includes an 
e-mail server message store 506 for receiving and storing all e-mail messages 
transmitted within the network 110 and an e-mail filter 504, (Paul et al.. Col. 8, Lines 
20-25), 
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The modified Paul et al. fails to teach that criteria includes an electronic message 
type or number of electronic messages emanating from a user, 

The modified Paul teaches an apparatus wherein: the criterion includes at least 
one of size of electronic message, (Tarbotton et al., Col. 7, lines 55-60), 

Tarbotton et al. teaches that the criteria includes an electronic message type, 
[Characteristics that may be used to determine the minimum delay period applied 
include sender characteristics, recipient characteristics, attachment type 
characteristics and message content type characteristics, (Tarbotton et al.. 
Abstract), 

and (c) number of electronic messages emanating from a user, [FIG. 5 
illustrates characteristics of a number of example received e-mail messages and 
how the rules of FIG. 4 may produce a minimum delay period for each message, 

(Tarbotton et a!., Col. 8, lines 15-18), to detect the unwanted properties as soon as an 
e-mail message is received or whilst it is being stored for the minimum delay period, 
and then these tests repeated only if they have been updated once the minimum delay 
period has expired, (Tarbotton et al.. Col. 3, lines 60-65), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by including an electronic message 
type, characteristics that may be used to determine the minimum delay period applied 
include sender characteristics, recipient characteristics, attachment type characteristics 
and message content type characteristics, (Tarbotton et al.. Abstract), 
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and (c) number of electronic messages emanating from a user, (Tarbotton et al., 
Col. 8, lines 15-18), to detect the unwanted properties as soon as an e-mail message is 
received or whilst it is being stored for the minimum delay period, and then these tests 
repeated only if they have been updated once the minimum delay period has expired, 
(Tarbotton et al., Col. 3, lines 60-65). 

Claims 25 - 30 are reiected under 35 U.S.C. 103(a) as being unpatentable over 
Paul et al. (US 6.052.709). in view of Steiqer et al. (US 7.484.097) and further in view 
of Khanna et al. (US 2002/0133604). 

Regarding claim 25 . The modified Paul et al. teaches a server according to claim 
1 , the server being arranged to receive authentication data from a terminal connected 
thereto, the authentication data being associated with one or more electronic messages, 
[The network users may or may not be given authorization to access or change 
the exclusion list data entered by the system operator, (Paul et al.. Col. 9, lines 52 
-55)], 

and the processing means being arranged to execute a decision to send a 
suspension request to the identified destination of that message in dependence on the 
comparison made by the comparison stage, [messages marked with the first display 
code indicating the "JUNK" status of the message are not displayed in the user's 
in-box and are automatically discarded by the filter, wherein the alert message 
discards the electronic message, (Paul et al.. Col. 6, lines 65 - 67)], 
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The modified Paul fails to teach that the server having configured to make a 
comparison between traffic log data corresponding to an identified message and the 
authentication data corresponding to-that message, 

Khanna et al. teaches the login unit to incorporate the authentication data in the 
at least one user entry that corresponds to the at least one instruction set In the 
instruction set database, wherein the login unit is to store log data related to logging in 
the user into the web site, (Khanna et al., Claim 10, Page 8), to retrieve the log data 
from the server, (Khanna et al.. Claim 10, Page 8), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the modified Paul by including that the server is 
configured to make a comparison between traffic log data corresponding to an identified 
message and the authentication data corresponding to-that message, the login unit to 
incorporate the authentication data in the at least one user entry that corresponds to the 
at least one instruction set in the instruction set database, wherein the login unit is to 
store log data related to logging in the user into the web site, (Khanna et al.. Claim 10, 
Page 8), to retrieve the log data from the server, (Khanna et al.. Claim 10, Page 8). 

Regarding claims 26 and 29 , the modified Paul et al. teaches the network users 
may or may not be given authorization to access or change the exclusion list data 
entered by the system operator, (Paul et al.. Col. 9, lines 52 - 55), 

The modified Paul et al. fails to teach that the authentication is encrypted. 
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Steiger et al. teaches a server according to claim 25, wherein: the authentication 
data is received in encrypted form, [transmissions may be encrypted so customer 
data and SOC resources may be protected, (Steiger et al., Col. 9, Lines 45 - 47)], 

the comparison stage being configured to decrypt the encrypted authentication 
data and to compare the decrypted data with the traffic log data, [transmissions may 
be encrypted so customer data and SOC resources may be protected, (Steiger et 
al.. Col. 9, Lines 45 - 47), in order to adequately protect computer information assets 
on a full-time basis, (Steiger et al.. Col. 1, lines 47 - 50), 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify Paul et al. by encrypting the authentication as taught by 
Steiger et al., (Steiger et al.. Col. 9, lines 45 - 47), in order to adequately protect 
computer information assets on a full-time basis, (Steiger et al.. Col. 1, lines 47 - 50). 

Regarding claim 27 and 30 . a terminal for sending and receiving electronic 
messages to and from a server according to claim 25, wherein the terminal has an 
interface, the interface having: a user input for receiving send instructions to send one 
or more specified electronic messages to a server, [A user interface 208 is provided 
to receive inputs from the user and to display e-mail information to the user, (Paul 
et a!., Col. 6, lines 32 - 35)], 

the user input being configured to receive a confirmation input from the user to 
confirm the send instructions, [upon receipt of an electronic mail message 
addressed to the probe address, (Paul et al.. Col. 2, lines 57 - 60)], 
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and wherein: in response to tlie confirmation input, tlie terminal is configured to 
send the specified electronic messages towards the server and to send authentication 
data associable with the specified electronic messages, [The network users may or 
may not be given authorization to access or change the exclusion list data 
entered by the system operator, (Paul et al., Col. 9, lines 52 - 55)]. 

Regarding claim 28 . a terminal according to claim 27 wherein: the terminal is 
configured to detect whether a traffic characteristic criterion relating to the specified 
electronic message is met, [Upon receipt of incoming mail addressed to the spam 
probe addresses, the spam control center automatically analyzes the received 
mail to identify the source of the message, extracts and processes the source 
data from the received message, wherein the received message is analyzed 
based on the characteristics that meet the criterion of a spam message, (Paul et 
a!., Col. 2, lines 1-5)], 

and to request a confirmation input from a user at the user interface in response 
to the criterion being met, [upon receipt of an electronic mail message addressed to 
the probe address, (Paul et al.. Col. 2, lines 57 - 60)]. 
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Conclusion 

Any inquiry concerning this communication or earlier communications from tine 
examiner should be directed to Shaq Taha whose telephone number is 571-270-1921 . 
The examiner can normally be reached on 8:30am-5pm Mon-Fri. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jeff Pwu can be reached on 571-272-6798. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. 

For more information about the PAIR system, see http://pair-direct.uspto.gov. 
Should you have questions on access to the Private PAIR system, contact the 
Electronic Business Center (EBC) at 866-217-9197 (toll-free?). 
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